Important Business Service

A firm cannot make everything unbreakable, so leadership needs a rule for what must be protected first. The important business service concept provides it: a service whose failure would cause intolerable harm to customers or threaten market stability. It forces the organisation to see itself from the outside, through what customers receive rather than what departments do. For a board, it shrinks an unmanageable landscape into a short list it can genuinely oversee.

Management proposes the list, the board approves it, and regulators such as the FCA and CBUAE expect it documented with an impact tolerance for each service. Each service is then mapped end to end across people, systems, suppliers and premises, and tested against severe scenarios, with results feeding the operational resilience self-assessment. A typical bank identifies 8-12 important business services, such as retail payments or account access, out of hundreds of internal processes. The mapping usually surprises: one service can depend on more than 30 components, including a single cloud contract.

The frequent mistake is listing internal functions, such as IT or HR, instead of services a customer would name. Another is a list of 40 important services, which means nothing is truly prioritised. The discipline is external harm first, a short list, hard tolerances. In the ERGP programme, a chapter of Module 3 on impact and BIA covers identifying services and setting their tolerances.